topic Re: How to extract a file name up to a specific character in Splunk Search

How to extract a file name up to a specific character

sheloaha — Tue, 29 Sep 2020 16:20:20 GMT

I have a list of files similar to this list:

FileObjMgr_01235_567.log
EIM_0080123_45.log
EIM_01031234_56.log
EIM_01272345_67.log
FINSObjMgr_56789_1234.log
File3Svc.log
SCFile_123456_1345.log
SRFile_5794_5879.log
ServerMgr_54525852_452.log
SvrTaskPersist_857494_58674.log
WfProcBatch_748490_5857.log
WfProcMgr_2971_9928.log
XMLPReporter_8751_35485.log

I am trying to extract the first part of the file name up to the "" character. Some files do not have an "" so I need the name up to .log. So far I've only been able to successfully pull names using this:

However I am getting too many characters as below. How to I extract just to the "_" and, if that is not present to .log?

EAIObjMg
EIM_0080
EIM_0103
EIM_0127
EIM_0151
EIM_0171
EIM_0191
EIM_0223
FINSObjM
MASL3Svc
SCBroker
SRBroker
ServerMg
SvrTaskP
WfProcBa
WfProcMg
XMLPRepo

Re: How to extract a file name up to a specific character

sheloaha — Wed, 18 Oct 2017 15:00:44 GMT

Sorry. That should read "up to the "_" character."

Re: How to extract a file name up to a specific character

gcusello — Wed, 18 Oct 2017 15:09:27 GMT

Hi sheloaha,
If I correctly understand, do you like to extract only chars before the first "_" if present, correct?
if this is your need use this regex

| rex field=source "^(?<myfield>[^_]*)"

Viewing you search I see an error: you cannot use | inputlookup in the middle of a search, only at starting point.

Bye.
Giuseppe

Re: How to extract a file name up to a specific character

kunalmao — Wed, 18 Oct 2017 15:27:25 GMT

you can try | rex field=source "(?\w*)_ "

Re: How to extract a file name up to a specific character

elliotproebstel — Wed, 18 Oct 2017 15:28:29 GMT

I believe you need this regex:

| rex field=source "^(?<mything>[^_\.]*)(_[^\.]*)?\.log"

The one @cusello posted above is close but will not extract the lines that do not contain underscores. He's also right, though, that you can't have an inputlookup in the middle of your search. Perhaps you meant to append the contents of the lookup file to the existing search results, in which case you'd want ...| append [ | inputlookup append=T filetypes_prod.csv ] | stats count by filetype...

Re: How to extract a file name up to a specific character

gcusello — Wed, 18 Oct 2017 15:37:24 GMT

Correct suggestion:

| rex field=source "^(?<myfield>[^_\.]*)"

Bye.
Giuseppe

Re: How to extract a file name up to a specific character

sheloaha — Wed, 18 Oct 2017 19:04:51 GMT

This worked great! And thanks everyone for correcting my inputlookup error.